Systems and methods for message threat management

ABSTRACT

The present invention is directed to systems and methods for detecting unsolicited and threatening communications and communicating threat information related thereto. Threat information is received from one or more sources; such sources can include external security databases and threat information data from one or more application and/or network layer security systems. The received threat information is reduced into a canonical form. Features are extracted from the reduced threat information; these features in conjunction with configuration data such as goals are used to produce rules, in some embodiments, these rules are tested against one or more sets of test data and compared against the same or different goals; if one or more tests fail, the rules are refined until the tests succeed within ah acceptable margin of error. The hues are then propagated to one or more application layer security systems.

CROSS-REFERENCE TO RELATED PATENT APPLICATIONS

This application is a continuation of commonly assigned U.S. patentapplication Ser. No. 11/456,960 (now U.S. Pat. No. 8,069,481), filedJul. 12, 2006, which is incorporated herein in its entirety and is acontinuation of commonly assigned U.S. patent application Ser. No.10/361,091 (now U.S. Pat. No. 7,096,498), filed Feb. 7, 2003, which isincorporated herein in its entirety and is a continuation-in-part ofcommonly assigned U.S. patent application Ser. Nos. 10/093,553 (now U.S.Pat. No. 6,941,467); 10/094,211 (now U.S. Pat. No. 7,458,098); and10/094,266 (now U.S. Pat. No. 7,124,438) all filed on Mar. 8, 2002,which are hereby incorporated herein in their entirety.

BACKGROUND

The present invention is directed to systems and methods for receivinginformation related to messaging threats, processing the information,and generating rules and policies in response to those threats. Morespecifically, without limitation, the present invention relates tocomputer-based systems and methods for responding to a range of threatsto messaging systems including viruses, spam, worms, and other attackson the server software.

The Internet is a global network of connected computer networks. Overthe last several years, the Internet has grown in significant measure. Alarge number of computers on the Internet provide information in variousforms. Anyone with a computer connected to the Internet can potentiallytap into this vast pool of information.

The information available via the Internet encompasses informationavailable via a variety of types of application layer informationservers such as SMTP (simple mail transfer protocol), POP3 (Post OfficeProtocol), GOPHER (RFC 1436), WAIS, HTTP (Hypertext Transfer Protocol,RFC 2616) and FTP (file transfer protocol, RFC 1123).

One of the most wide spread method of providing information over theInternet is via the World Wide Web (the Web). The Web consists of asubset of the computers connected to the Internet; the computers in thissubset run Hypertext Transfer Protocol (HTTP) servers (Web servers).Several extensions and modifications to HTTP have been proposedincluding, for example, an extension framework (RFC 2774) andauthentication (RFC 2617). Information on the Internet can be accessedthrough the use of a Uniform Resource Identifier (URI, RFC 2396). A URIuniquely specifies the location of a particular piece of information onthe Internet. A URI will typically be composed of several components.The first component typically designates the protocol by which theaddress piece of information is accessed (e.g., HTTP, GOPHER, etc.).This first component is separated from the remainder of the URI by acolon (‘:’). The remainder of the URI will depend upon the protocolcomponent. Typically, the remainder designates a computer on theInternet by name, or by IP number, as well as a more specificdesignation of the location of the resource on the designated computer.For instance, a typical URI for an HTTP resource might be:

http://www.server.com/dir1/dir2/resource.htm

where http is the protocol, www.server.com is the designated computerand /dir1/dir2/resouce.htm designates the location of the resource onthe designated computer. The term URI includes Uniform Resource Names(URN's) including URN's as defined according to RFC 2141.

Web servers host information in the form of Web pages; collectively theserver and the information hosted are referred to as a Web site. Asignificant number of Web pages are encoded using the Hypertext MarkupLanguage (HTML) although other encodings using extensible MarkupLanguage (XML) or XHTML. The published specifications for theselanguages are incorporated by reference herein; such specifications areavailable from the World Wide Web Consortium and its Web site(http://www.w3c.org). Web pages in these formatting languages mayinclude links to other Web pages on the same Web site or another. Aswill be known to those skilled in the art, Web pages may be generateddynamically by a server by integrating a variety of elements into aformatted page prior to transmission to a Web client Web servers, andinformation servers of other types, await requests for the informationfrom Internet clients.

Client software has evolved that allows users of computers connected tothe Internet to access this information. Advanced clients such asNetscape's Navigator and Microsoft's Internet Explorer allow users toaccess software provided via a variety of information servers in aunified client environment. Typically, such client software is referredto as browser software.

Electronic mail (e-mail) is another wide spread application using theInternet. A variety of protocols are often used for e-mail transmission,delivery and processing including SMTP and POP3 as discussed above.These protocols refer, respectively, to standards for communicatinge-mail messages between servers and for server-client communicationrelated to e-mail messages. These protocols are defined respectively inparticular RFC's (Request for Comments) promulgated by the IETF(Internet Engineering Task Force). The SMTP protocol is defined in RFC821, and the POP3 protocol is defined in RFC 1939.

Since the inception of these standards, various needs have evolved inthe field of e-mail leading to the development of further standardsincluding enhancements or additional protocols. For instance, variousenhancements have evolved to the SMTP standards leading to the evolutionof extended SMTP. Examples of extensions may be seen in (1) RFC 1869that defines a framework for extending the SMTP service by defining ameans whereby a server SMTP can inform a client SMTP as to the serviceextensions it supports and in (2) RFC 1891 that defines an extension tothe SMTP service, which allows an SMTP client to specify (a) thatdelivery status notifications (DSNs) should be generated under certainconditions, (b) whether such notifications should return the contents ofthe message, and (c) additional information, to be returned with a DSN,that allows the sender to identify both the recipients) for which theDSN was issued, and the transaction in which the original message wassent.

In addition, the IMAP protocol has evolved as an alternative to POP3that supports more advanced interactions between e-mail servers andclients. This protocol is described in RFC 2060.

The various standards discussed above by reference to particular RFC'sare hereby incorporated by reference herein for all purposes. TheseRFC's are available to the public through the IETF and can be retrievedfrom its Web site (http://www.ietf.org/rfc.html). The specifiedprotocols are not intended to be limited to the specific RFC's quotedherein above but are intended to include extensions and revisionsthereto. Such extensions and/or revisions may or may not be encompassedby current and/or future RFC's.

A host of e-mail server and client products have been developed in orderto foster e-mail communication over the Internet E-mail server softwareincludes such products as sendmail-based servers, Microsoft Exchange,Lotus Notes Server, and Novell Group Wise; sendmail-based servers referto a number of variations of servers originally based upon the sendmailprogram developed for the UNIX operating systems. A large number ofe-mail clients have also been developed that allow a user to retrieveand view e-mail messages from a server; example products includeMicrosoft Outlook, Microsoft Outlook Express, Netscape Messenger, andEudora. In addition, some e-mail servers, or e-mail servers inconjunction with a Web server, allow a Web browser to act as an e-mailclient using the HTTP standard.

As the Internet has become more widely used, it has also created newrisks for corporations. Breaches of computer security by hackers andintruders and the potential for compromising sensitive corporateinformation are a very real and serious threat Organizations havedeployed some or all of the following security technologies to protecttheir networks from Internet attacks.

Firewalls have been deployed at the perimeter of corporate networks.Firewalls act as gatekeepers and allow only authorized users to access acompany network. Firewalls play an important role in controlling trafficinto networks and are an important first step to provide Internetsecurity.

Intrusion detection systems (IDS) are being deployed throughoutcorporate networks. While the firewall acts as a gatekeeper, IDS actlike a video camera. EDS monitor network traffic for suspicious patternsof activity, and issue alerts when that activity is detected. IDSproactively monitor your network 24 hours a day in order to identifyintruders within a corporate or other local network.

Firewall and IDS technologies have helped corporations to protect theirnetworks and defend their corporate information assets. However, as useof these devices has become widespread, hackers have adapted and are nowshifting their point-of-attack from the network to Internetapplications. The most vulnerable applications are those that require adirect, “always-open” connection with the Internet such as web ande-mail. As a result, intruders are launching sophisticated attacks thattarget security holes within these applications.

Many corporations have installed a network firewall, as one measure incontrolling the flow of traffic in and out of corporate computernetworks, but when it comes to Internet application communications suchas e-mail messages and Web requests and responses, corporations oftenallow employees to send and receive from or to anyone or anywhere insideor outside the company. This is done by opening a port, or hole in theirfirewall (typically, port 25 for e-mail and port 80 for Web), to allowthe flow of traffic. Firewalls do not scrutinize traffic flowing throughthis port This is similar to deploying a security guard at a company'sentrance but allowing anyone who looks like a serviceman to enter thebuilding. An intruder can pretend to be a serviceman, bypass theperimeter security, and compromise the serviced Internet application:

FIG. 1 depicts a typical prior art server access architecture. With in acorporation's local network 190, a variety of computer systems mayreside. These systems typically-include application servers 120 such asWeb servers and e-mail servers, user workstations running local clients130 such as e-mail readers and Web browsers, and data storage devices110 such as databases and network connected disks. These systemscommunicate with each other via a local communication network such asEthernet 150. Firewall system 140 resides between the localcommunication network and Internet 160. Connected to the Internet 160are a host of external servers 170 and external clients 180.

Local clients 130 can access application servers 120 and shared datastorage 110 via the local communication network. External clients 180can access external application servers 170 via the Internet 160. Ininstances where a local server 120 or a local client 130 requires accessto an external server 170 or where an external client 180 or an externalserver 170 requires access to a local server 120, electroniccommunications in the appropriate protocol for a given applicationserver flow through “always open” ports of firewall system 140.

The security risks do not stop mere. After taking over the mail server,it is relatively easy for the intruder to use it as a launch pad tocompromise other business servers and steal critical businessinformation. This information may include financial data, salesprojections, customer pipelines, contract negotiations, legal matters,and operational documents. This kind of hacker attack on servers cancause immeasurable and irreparable losses to a business.

In the 1980's, viruses were spread mainly by floppy diskettes. Intoday's interconnected world, applications such as e-mail serve as atransport for easily and widely spreading viruses. Viruses such as “ILove You” use the technique exploited by distributed Denial of Service(DDoS) attackers to mass propagate. Once the “I Love You” virus isreceived, the recipient's Microsoft Outlook sends emails carryingviruses to everyone in the Outlook address book. The “I Love You” virusinfected millions of computers within a short time of its release.Trojan horses, such as Code Red use this same technique to propagatethemselves. Viruses and Trojan horses can cause significant lostproductivity due to down time and the loss of crucial data.

The Nimda worm simultaneously attacked both email and web applications.It propagated itself by creating and sending infectious email messages,infecting computers over the network and striking vulnerable MicrosoftUS Web servers, deployed on Exchange mail servers to provide web mail.

Most e-mail and Web requests and responses are sent in plain text today,making it just as exposed as a postcard. This includes the e-mailmessage, its header, and its attachments, or in a Web context, a username and password and/or cookie information in an HTTP request. Inaddition; when you dial into an Internet Service Provider (ISP) to sendor receive e-mail messages, the user ID and password are also sent inplain text, which can be snooped, copied, or altered. This can be donewithout leaving a trace, making it impossible to know whether a messagehas been compromised.

As the Internet has become more widely used, it has also created newtroubles for users. In particular, the amount of “spam” received byindividual users has increased dramatically in the recent past Spam, asused in this specification, refers to any communication receipt of whichis either unsolicited or not desired by its recipient.

The following are additional security risks caused by Internetapplications:

-   -   E-mail spamming consumes corporate resources and impacts        productivity. Furthermore, spammers use a corporation's own mail        servers for unauthorized email relay, making it appear as if the        message is coming from that corporation.    -   E-mail and Web abuse, such as sending and receiving        inappropriate messages and Web pages, are creating liabilities        for corporations. Corporations are increasingly facing        litigation for sexual harassment or slander due to e-mail their,        employees have sent or received.    -   Regulatory requirements such as the Health Insurance Portability        and Accountability Act (HIPAA) and the Gramm-Leach-Bliley Act        (regulating financial institutions) create liabilities for        companies where confidential patient or client information may        be exposed in e-mail and/or Web servers or communications        including e-mails, Web pages and HTTP requests.

Using the “always open” port, a hacker can easily reach an appropriateInternet application server, exploit its vulnerabilities, and take overthe server. This provides hackers easy access to information availableto the server, often including sensitive and confidential information.The systems and methods according to the present invention provideenhanced security for communications involved with such Internetapplications requiring an “always-open” connection.

Anti-spam systems in use today include fail-open systems in which allincoming messages are filtered for spam. In these systems, a message isconsidered not to be spam until, some form of examination provesotherwise. A message is determined to be spam based on an identificationtechnique. Operators of such systems continue to invest significantresources in efforts to reduce the number of legitimate messages thatare misclassified as spam. The penalties for any misclassification aresignificant and therefore most systems are designed to be predisposednot to classify messages as spam.

One such approach requires a user to explicitly list users from whomemail is desirable. Such a list is one type of “whitelist”. There arecurrently two approaches for creating such a whitelist. In a desktopenvironment, an end-user can import an address book as the whitelist.This approach can become a burden when operated at a more centrallocation such as the gateway of an organization. Therefore, someorganizations only add a few entries to the whitelist as necessary. Inthat case, however, the full effect of whitelisting is not achieved. Thepresent invention improves upon these systems by including a system thatallows a more effective solution for whitelisting while requiringreduced manual effort by end-users or administrators. The presentinvention also allows a whitelist system to be strengthened byauthenticating sender information.

Other systems in use today employ a fail-closed system in which a sendermust prove its legitimacy. A common example of this type of system usesa challenge and response. Such a system blocks all messages from unknownsenders and itself sends a confirmation message to the sender. Thesender must respond to verify that it is a legitimate sender. If thesender responds, the sender is added to the whitelist However, spammerscan create tools to respond to the confirmation messages. Someconfirmation messages are more advanced in an effort to require that ahuman send the response. The present invention is an improvement uponthese systems. The present invention can reference information providedby users to determine who should be whitelisted rather than rely on thesender's confirmation. The systems and methods according to the presentinvention provide enhanced accuracy in the automated processing ofelectronic communications.

U.S. Pat. No. 6,052,709, the disclosure of which is incorporated hereinby this reference, assigned to Bright Light Technologies discloses asystem for collecting spam messages so that rules can be created andsent to servers. The disclosed system includes the steps of datacollection, rule creation, and distribution of rules to clients. Thedisclosed system is directed to a particular method of data collectionfor spam messages. No system or method for creating rules based on inputdata are disclosed. Nor does it disclose a systematic approach togenerating rules. Furthermore, the disclosed system is limited to spamthreats and only allows one type of input The threat management centerof the present invention is operative on all messaging threatsincluding, but not limited to, spam, virus, worms, Trojans, intrusionattempts, etc. The threat management center of the present inventionalso includes novel approaches to the process of rule creation.Additionally, the present invention improves on the state of the art byproviding a more generalized and useful data collection approach. Thedata collection system of the present invention includes modules thatprocess input into data that can be used by the rule creation process.The present invention can also use feedback from application layersecurity servers as input to the rule creation process.

U.S. patent application Ser. No. 10/154,137 (publication 2002/0199095A1), the disclosure of which is incorporated herein by this reference,discloses a system for message filtering. The disclosed system allowsspam messages to be forwarded to a database by users of the system. Incontrast, the systems and methods of the present invention do not relyon the users; rather the messaging security system(s) can automaticallydetermine spam using identification techniques and then forward theresults to a database. The system of the present invention can add knownspam messages as well as misclassified messages forwarded by users tothe database to retrain the system. Systems known in the art require theforwarding of entire messages to the databases. In the presentinvention, individual messaging or application layer security systemscan extract meaningful features from spam messages, threatening messagesand/or non-spam/non-threatening messages and forward only relevantfeatures to a database.

U.S. Pat. No. 6,161,130, the disclosure of which is incorporated hereinby this reference, discloses a technique for detecting “junk” email. Thedisclosed system is operative only on spam and not the entire class ofmessaging security threats. The inputs for the disclosed system arelimited spam and non-spam e-mail. This patent discloses text analysisbased features such as the tokens in a message. This patent discloses“predefined handcrafted distinctions” but does not further disclose whatthey are or how these can be created. The system of the presentinvention can classify based on not only the text analysis but alsoother features of messages. Additionally, the system of the presentinvention can include fully automated feature extraction for non-textbased features.

In addition, known security systems have been developed to providepeer-to-peer communication of threat information. Such systems aretypically designed for a ring of untrusted peers and therefore addresstrust management between the peers. Additionally, current peer-to-peersystems do hot have a central entity. The system of the presentinvention operates between a set of trusted peers; therefore, trustmanagement need not be addressed by the present invention. Further, acentralized threat management system coordinates threat informationamong multiple trusted application layer security systems communicatingin a peer-to-peer manner. Therefore, the threat notification system canprocess more real-time data exchange. This makes the distributed IDS(intrusion detection system) more scalable.

In addition, current systems only exchange intrusion alerts. Thesesystems can only notify each other of attacks of which they are aware.While the underlying detection method could be misuse or anomalydetection, the data exchanged is only the detected attack information.The system of the present invention distributes more general informationabout traffic patterns as well as specific threat information. As anon-limiting example, if anomaly detection is used, the system of thepresent invention can exchange the underlying statistics instead ofwaiting for the statistics to indicate an attack. Exchanged statisticscan include information about the frequency of certain attacks.Therefore, even if other systems already have a signature for a certainattack, the system of the present invention will notify them of anoutbreak of this attack. Additionally, traffic patterns can be exchangedamong peers and that information can be further processed by the otherpeers to infer a global view of traffic patterns. This informationexchange can be similar to routing protocols that allow each node toinfer a global view of the network topology.

SUMMARY

The present invention is directed to systems and methods for messagingthreat protection. A typical architecture includes the followingcomponents: 1) a centralized threat management center that can collectthreat information and create rules and/or policies for messagingsecurity systems, 2) a peer-to-peer based messaging notification systemthat is operative between messaging security systems, and 3) ahierarchical messaging pushback system that blocks communications asclose as possible to the source by sending notifications to systems on apath towards the source.

A preferred embodiment according to the present invention for a threatmanagement center, a threat pushback system or a peer-to-peerapplication layer security system communication environment each alone,or as an overall environment, include a system data store (SDS), asystem processor and one or more interfaces to one or morecommunications networks over which electronic communications aretransmitted and received. The SDS stores data needed to provide thedesired system functionality, and may include, for example, receivedcommunications, data associated with such communications, informationrelated to known security risks, information related to corporate policywith respect to communications for one or more applications (e.g.,corporate e-mail policy, Web access guidelines, message interrogationparameters, and whitelists) and predetermined responses to theidentification of particular security risks, situations or anomalies.

The SDS may include multiple physical and/or logical data stores forstoring the various types of information. Data storage and retrievalfunctionality may be provided by either the system processor or datastorage processors associated with the data store. The system processoris in communication with the SDS via any suitable communicationchannel(s); the system processor is in communication with the one ormore interfaces via the same, or differing, communication channel(s).The system processor may include one or more processing elements thatprovide electronic communication reception, transmission, interrogation,analysis and/or other functionality.

In a threat management center, the SDS may further include one or moresets of threat management goals and/or one or more sets of test data.Accordingly, one preferred threat management method includes a varietyof steps that may, in certain embodiments, be executed by theenvironment summarized above and more fully described below or be storedas computer executable instructions in and/or on any suitablecombination of computer-readable media. Threat information is receivedfrom one or more sources; such sources can include external securitydatabases and threat information data from one or more applicationand/or network layer security systems. The received threat informationis reduced into a canonical form. Features are extracted from thereduced threat information; these features in conjunction withconfiguration data such as goals are used to produce rules. In someembodiments, these rules are tested against one or more sets of testdata and compared against the same or different goals; if one or moretests fail, the rules are refined until the tests succeed within anacceptable margin of error. The rules are then propagated to one or moreapplication layer security systems.

One preferred threat pushback method includes a variety of steps thatmay, in certain embodiments, be executed by the environment summarizedabove and more fully described below or be stored as computer executableinstructions in and/or on any suitable combination of computer-readablemedia. A communication is received. A threat profile associated with thereceived communication is generated. In some cases, the generationoccurs through application of one or more tests to the receivedcommunication, wherein each of the one or more tests evaluates thereceived communication for a particular security risk. In otherinstance, a manual entry of a threat profile via a provided interfaceserves to generate the threat profile. The threat profile is comparedwith configuration information. Typically, configuration information caninclude threat types of interest and weights associated therewith. Insome embodiments, the comparison is accomplished by calculating a threatvalue from the threat profile and determining whether the threat valuesatisfies a predetermined threat condition. If the comparison indicatesthe received communication represents a threat, one or more computer,addresses in a back path of the received communication are identified,and information based upon the stored threat profile is outputted.

In some embodiments, identified address along the back path areauthenticated prior to propagation of threat information. In otherembodiments, an interface may be provided to allow establishingconfiguration information regarding one or more threat types, whereinconfiguration information comprises threat types of interest and weightsassociated therewith.

Accordingly, one preferred method of whitelist usage, includes a varietyof steps that may, in certain embodiments, be executed by theenvironment summarized above and more fully described below or be storedas computer executable, instructions in and/or on any suitablecombination of computer-readable media. In some embodiments, anelectronic communication directed to or originating from an applicationserver is received. The source of the electronic communication may beany appropriate internal or external client or any appropriate internalor external application server. One or more tests are applied to thereceived electronic communication to evaluate the received electroniccommunication for a particular security risk. A risk profile associatedwith the received electronic communication is stored based upon thistesting. The stored risk profile is compared against data accumulatedfrom previously received electronic communications to determine whetherthe received electronic communication is anomalous. If the receivedcommunication is determined to be anomalous, an anomaly indicator signalis output. The output anomaly indicator signal may, in some embodiments,notify an application server administrator of the detected anomaly by anappropriate notification mechanism (e.g., pager, e-mail, etc.) ortrigger some corrective measure such as shutting down the applicationserver totally, or partially (e.g., deny access to all communicationsfrom a particular source).

Some embodiments may provide support for communicating information basedupon the stored risk profile to a threat notification system to afurther security appliance or further security appliances. Withoutlimitation, such security appliances can include threat managementcenters and other application layer security systems. Such communicationof information can be instead of, or in addition to, any anomalyindicator signal. In some embodiments, anomaly detection need not occur,nor does an anomaly indicator signal need to be output.

In some embodiments, an electronic communication directed to ororiginating from an email server is received. One or more tests can beapplied to the received electronic communication to compare the sender'saddress in the received electronic communication to addresses contained,in one or more whitelists.

Some embodiments may also support a particular approach to testing thereceived electronic communication, which may also be applicable for usein network level security and intrusion detection. In such embodiments,each received communication is interrogated by a plurality ofinterrogation engines where each such interrogation engine is of aparticular type designed to test the communication for a particularsecurity risk. Each received communication is interrogated by a seriesof interrogation engines of differing types. The ordering and selectionof interrogation engine types for use with received communications may,in some embodiments, be configurable, whereas in others the ordering andselection may be fixed.

Associated with each interrogation engine is a queue of indices forcommunications to be evaluated by the particular interrogation engine.When a communication is received, it is stored and assigned an index.The index for the receive communication is placed in a queue associatedwith an interrogation of a particular type as determined by theinterrogation engine ordering. Upon completion of the assessment of thereceived communication by the interrogation engine associated with theassigned queue, the index is assigned to a new queue associated with aninterrogation engine of the next type as determined by the interrogationengine ordering. The assignment process continues until the receivedcommunication has been assessed by an interrogation engine of each typeas determined by the interrogation engine selection. If thecommunication successfully passes an interrogation engine of each type,the communication is forwarded to its appropriate destination. In someembodiments, if the communication fails any particular engine, a warningindicator signal may be output; in some such embodiments, thecommunication may then be forwarded with of without an indication of itsfailure to its appropriate destination, to an application administratorand/or both.

In some embodiments using this queuing approach, the assignment of anindex for a received communication to a queue for an interrogationengine of a particular type may involve an evaluation of the currentload across all queues for the particular interrogation engine type. Ifa threshold load exists, a new instance of an interrogation engine ofthe particular type may be spawned with an associated index queue. Theindex for the received communication may then be assigned to the queueassociated with the interrogation engine instance. In some embodiments,the load across the queues associated with the particular type may beredistributed across the queues including the one associated with thenew interrogation engine instance prior to the assignment of the indexassociated with the newly received communication to the queue. Someembodiments may also periodically, or at particular times such as adetermination that a particular queue is empty, evaluate the load acrossqueues for a type of interrogation engine and if an inactivity thresholdis met, shutdown excess interrogation instances of that type anddisassociating or deallocating indices queues associated with shutdowninstances.

Alternatively, a fixed number of interrogation engines of eachparticular type may be configured in which case dynamic instancecreation may or may not occur. In fixed instance embodiments notsupporting dynamic instance creation, assignment to a particular queuemay result from any appropriate allocation approach including loadevaluation or serial cycling through queues associated with eachinterrogation engine instance of the particular type desired.

In some embodiments, anomaly detection may occur through a processoutlined as follows. In such a process, data associated with a receivedcommunication is collected. The data may be accumulated from a varietyof source such as from the communication itself and from the manner ofits transmission and receipt. The data may be collected in anyappropriate manner such as the multiple queue interrogation approachsummarized above and discussed in greater detail below. Alternatively,the data collection may result from a parallel testing process where avariety of test is individually applied to the received communication inparallel. In other embodiments, a single combined analysis such as vianeural network may be applied to simultaneously collect data associatedwith the received communication across multiple dimensions.

The collected data is then analyzed to determine whether the receivedcommunication represents an anomaly. The analysis will typically bebased upon the collected data associated with the received communicationin conjunction with established communication patterns over a given timeperiod represented by aggregated data associated with previouslyreceived communications. The analysis may further be based upon definedand/or configurable anomaly rules. In some embodiments, analysis may becombined with the data collection; for instance, a neural network couldboth collect the data associated with the received communication andanalyze it.

The adaptive communication interrogation can use establishedcommunication patterns over a given time period represented byaggregated data associated with previously received communications. Theanalysis can further be based upon defined and/or configurable spamrules. In some embodiments, analysis can be combined with the datacollection; for instance, a neural network could both collect the dataassociated with the received communication and analyze it.

Finally, if an anomaly is detected with respect to the receivedcommunication, an indicator signal is generated. The generated signalmay provide a warning to an application administrator or trigger someother appropriate action. In some embodiments, the indicator signalgenerated may provide a generalized indication of an anomaly, in otherembodiments, the indicator may provide additional data as to a specificanomaly, or anomalies, detected. In the latter embodiments, any warningand/or actions resulting from the signal may be dependent upon theadditional data.

Data collected from received communications can be analyzed to determinewhether the received communication is on one or more whitelists. Theanalysis is typically based upon the collected data associated with thereceived communication in conjunction with reference to one or morewhitelists. If no match to a whitelist is found, the communication canbe subject to a certain level of interrogation. If a match to thewhitelist is found, the communication can either bypass any messageinterrogation or it can be subject to a different level ofinterrogation. In one preferred embodiment, if a match to a whitelist isfound, the message can be subject to either adaptive messageinterrogation or no message interrogation. If no match to a whitelist isfound, the message can be subject to normal message interrogation.Additionally, a whitelist can be created and/or updated based onoutbound communication. In one preferred embodiment, some or all of thedestination addresses of outbound communications are added to awhitelist If a destination address already appears on a whitelist, aconfidence value associated with the destination can be modified basedupon the destination address' presence. For instance, a usage count maybe maintained; such a usage count can reflect absolute usage of theaddress or usage of the address over a given period of time.

Additional advantages of the invention will be set forth in part in thedescription which follows, and in part will be obvious from thedescription, or may be learned by practice of the invention. Theadvantages of the invention will be realized and attained by means ofthe elements and combinations particularly pointed out in the appendedclaims. It is to be understood that both the foregoing generaldescription and the following detailed description are exemplary andexplanatory only and are not restrictive of the invention, as claimed.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are incorporated in and constitute apart of this specification, illustrate embodiments of the invention andtogether with the description; serve to explain the principles of theinvention.

FIG. 1 depicts a typical prior art access environment.

FIG. 2 depicts a hardware diagram for an environment using one preferredembodiment according to the present invention.

FIG. 3 is a logical block diagram of the components in a typicalembodiment of the present invention.

FIG. 4 is a flow chart of an exemplary anomaly detection processaccording to the present invention.

FIG. 5 is a sample anomaly detection configuration interface screen.

FIG. 6 is a bock diagram depicting the architecture of an exemplaryembodiment of a security enhancement system according to the presentinvention.

FIG. 7 is a block diagram depicting the architecture of an exemplaryembodiment of a risk assessment approach according to the presentinvention using multiple queues to manage the application of a pluralityof risk assessments to a received communication.

FIGS. 8A-8B are a flow chart depicting the process of accessing riskassociated with a received communication using the architecture depictedin FIG. 7.

FIG. 9 is a flow chart of an exemplary communication assessment processaccording to the present invention.

FIG. 10 is a flow chart of an exemplary whitelist management processaccording to the present invention.

FIG. 11 is a flow chart of an exemplary interrogation process accordingto the present invention.

FIG. 12 depicts an overview of information flow through one preferredembodiment of the threat management architecture.

FIG. 13 depicts a block diagram of the Threat Management Center (TMC)using one preferred embodiment according to the present invention.

FIG. 14 depicts an exemplary Threat Pushback System using one preferredembodiment according to the present invention.

FIG. 15 depicts components of a typical individual Messaging SecuritySystem (or application layer security system) according to the presentinvention.

DETAILED DESCRIPTION

Exemplary embodiments of the present invention are now described indetail. Referring to the drawings, like numbers indicate like partsthroughout the views. As used in the description herein and throughoutthe claims that follow, the meaning of “a,” “an,” and “the” includesplural reference unless the context clearly dictates otherwise. Also, asused in the description herein and throughout the claims that follow,the meaning of “in” includes “in” and “on” unless the context clearlydictates otherwise. Finally, as used in the description herein andthroughout the claims that follow, the meanings of “and” and “or”include both the conjunctive and disjunctive and may be usedinterchangeably unless the context clearly dictates otherwise.

Ranges may be expressed herein as from “about” one particular value,and/or to “about” another particular value. When such a range isexpressed, another embodiment includes from the one particular valueand/or to the other particular value. Similarly, when values areexpressed as approximations, by use of the antecedent “about,” it willbe understood that the particular value forms another embodiment. Itwill be further understood that the endpoints of each of the ranges aresignificant both in relation to the other endpoint, and independently ofthe other endpoint.

Architecture of a Typical Access Environment

FIG. 12 depicts an overview of information flow through one environmentusing various aspect of the threat management architecture, of thepresent invention. At the Message Security System (MSS) (e.g., 1205),statistics can be collected based on traffic and threat patterns. Thestatistics can be processed locally by an individual MSS, or they can beprocessed by an external processor. An MSS is an example of anapplication layer security system such as hardware device 210. Detailedinformation can be sent from one or more MSS back to the ThreatManagement Center (TMC) 1210. In some embodiments, information can beshared among MSSs in the network. In some embodiments, a plurality ofMSSs may operate as a peer-to-peer system 1215. In a preferredembodiment information gathered and/or computed statistics can be sentfrom a MSS 1205 to the threat notification and pushback system 1220.

Application Layer Security System

FIG. 15 depicts message flow through an exemplary Message InterrogationEngine (MIE) 4035, described in greater detail herein below. The MIE canuse rules and policies to perform interrogation. Input from the TMC canbe added to the set of rules and policies 4005. The MIE produces a setof statistics 4010 based on its recorded history. The statisticsprocessing module (SPM) 4025 can process this information and prepare itfor distribution. Certain information can be sent back to the TMC foranalysis 4030. Information can be sent to and from peers 4015 as part ofthe peer-based threat notification system. Information is also pushed totowards the source using the threat pushback system 4020. The SPM 4010can also receive input from the peer-based threat notification systemand the threat pushback system. Based on its history and analysis; theSPM 4010 can create new rules and policies 4005 for the local MIE.

FIG. 2 depicts a typical environment according to the present invention.As compared with FIG. 1, the access environment using systems andmethods according to the present invention may include a hardware device210 connected to the local communication network such as Ethernet 180and logically interposed between the firewall system 140 and the localservers 120 and clients 130. All application related electroniccommunications attempting to enter or leave the local communicationsnetwork through the firewall system 140 are routed to the hardwaredevice 210 for application level security assessment and/or anomalydetection. Hardware device 210 need not be physically separate fromexisting hardware elements managing the local communications network.For instance, the methods and systems according to the present inventioncould be incorporated into a standard firewall system 140 or router (notshown) with equal facility. In environment not utilizing a firewallsystem, the hardware device 210 may still provide application levelsecurity assessment and/or anomaly detection.

For convenience and exemplary purposes only, the foregoing discussionmakes reference to hardware device 210; however, those skilled in theart will understand that the hardware and/or software used to implementthe systems and methods according to the present invention may reside inother appropriate network management hardware and software elements.Moreover, hardware device 210 is depicted as a single element. Invarious embodiments, a multiplicity of actual hardware devices may beused. Multiple, devices that provide security enhancement forapplication servers of a particular type such as e-mail or Web may beused where communications of the particular type are allocated among themultiple devices by an appropriate allocation strategy such as (1)serial assignment that assigns a communication to each devicesequentially or (2) via the use of a hardware and/or software loadbalancer that assigns a communication to the device based upon currentdevice burden. A single device may provide enhanced security acrossmultiple application server types, or each device may only provideenhanced security for a single application server type.

In one embodiment, hardware device 210 may be a rack-mounted Intel-basedserver at either 1 U or 2 U sizes. The hardware device 210 can beconfigured with redundant components such as power supplies, processorsand disk arrays for high availability and scalability. The hardwaredevice 210 may include SSL/TLS accelerators for enhanced performance ofencrypted messages.

The hardware device 210 will include a system processor potentiallyincluding multiple processing elements where each processing element maybe supported via Intel-compatible processor platforms preferably usingat least one PENTIUM III or CELERON (Intel Corp., Santa Clara, Calif.)class processor; alternative processors such as UltraSPARC (SunMicrosystems, Palo Alto, Calif.) could be used mother embodiments. Insome embodiments, security enhancement functionality, as furtherdescribed below, may be distributed across multiple processing elements.The term processing element may refer to (1) a process running on aparticular piece, or across particular pieces, of hardware, (2) aparticular piece of hardware, or either (1) or (2) as the contextallows.

The hardware device 210 would have an SDS that could include a varietyof primary and secondary storage elements. In one preferred embodiment,the SDS would include RAM as part of the primary storage; the amount ofRAM might range from 128 MB to 4 GB although these amounts could varyand represent overlapping use such as where security enhancementaccording to the present invention is integrated into a firewall system.The primary storage may in some embodiments include other forms ofmemory such as cache memory, registers, non-volatile memory (e.g.,FLASH, ROM, EPROM, etc.), etc.

The SDS may also include secondary storage including single, multipleand/or varied servers and storage elements. For example, the SDS may useinternal storage devices connected to the system processor. Inembodiments where a single processing element supports all of thesecurity enhancement functionality, a local hard disk drive may serve asthe secondary storage of the SDS, and a disk operating system executingon such a single processing element may act as a data server receivingand servicing data requests.

It will be understood by those skilled in the art that the differentinformation used in the security enhancement processes and systemsaccording to the present invention may be logically or physicallysegregated within a single device serving as secondary storage for theSDS; multiple related data stores accessible through a unifiedmanagement-system, which together serve as the SDS; or multipleindependent data stores individually accessible through disparatemanagement systems, which may in some embodiments be collectively viewedas the SDS. The various storage elements that comprise the physicalarchitecture of the SDS may be centrally located, or distributed acrossa variety of diverse locations.

The architecture of the secondary storage of the system data store mayvary significantly in different embodiments. In several embodiments,database(s) are used to store and manipulate the data; in some suchembodiments, one or more relational database management systems, such asDB2 (IBM, White Plains, N.Y.), SQL Server (Microsoft, Redmond, Wash.),ACCESS (Microsoft, Redmond, Wash.), ORACLE 8i (Oracle Corp., RedwoodShores, Calif.), Ingres (Computer Associates, Islandia, N.Y.), MySQL(MySQL AB, Sweden) or Adaptive Server Enterprise (Sybase Inc.,Emeryville, Calif.), may be used in connection with a variety of storagedevices/file servers that may include one or more standard magneticand/or optical disk drives using any appropriate interface including,without limitation, IDE and SCSI. In some embodiments, a tape librarysuch as Exabyte X80 (Exabyte Corporation, Boulder, Colo.), a storageattached network (SAN) solution such as available from (EMC, Inc.,Hopkinton, Mass.), a network attached storage (NAS) solution such as aNetApp Filer 740 (Network Appliances, Sunnyvale, Calif.), orcombinations thereof may be used. In other embodiments, the data storemay use database systems with other architectures such asobject-oriented, spatial, object-relational or hierarchical or may useother storage implementations such as hash tables or flat files orcombinations of such architectures. Such alternative approaches may usedata servers other than database management systems such as a hash tablelook-up server, procedure and/or process and/or a flat file retrievalserver, procedure and/or process. Further, the SDS may use a combinationof any of such approaches in organizing its secondary storagearchitecture.

The hardware device 210 would have an appropriate operating system suchas WINDOWS/NT, WINDOWS 2000 or WINDOWS/XP Server (Microsoft, Redmond,Wash.), Solaris (Sun Microsystems, Palo Alto, Calif.), or LINUX (orother UNIX variant). In one preferred embodiment, the hardware device210 includes a pre-loaded, pre-configured, and hardened UNIX operatingsystem based upon FreeBSD (FreeBSD, Inc., http://www.freebsd.org). Inthis embodiment, the UNIX kernel has been vastly reduced, eliminatingnon-essential user accounts, unneeded network services, and anyfunctionality that is not required for security enhancement processing.The operating system code has been significantly modified to eliminatesecurity vulnerabilities.

Depending upon the hardware/operating system platform, appropriateserver software may be included to support the desired access for thepurpose of configuration, monitoring and/or reporting. Web serverfunctionality may be provided via an Internet Information-Server(Microsoft, Redmond, Wash.), an Apache HTTP Server (Apache SoftwareFoundation, Forest Hill, Md.), an iPlanet Web Server (iPlanet E-CommerceSolutions—A Sun—Netscape Alliance, Mountain View, Calif.) or othersuitable Web server platform. The e-mail services may be supported viaan Exchange Server (Microsoft, Redmond, Wash.), sendmail or othersuitable e-mail server. Some embodiments may include one or moreautomated voice response (AVR) systems that are in addition to, orinstead of, the aforementioned access servers. Such an AVR system couldsupport a purely voice/telephone driven interface to the environmentwith hard copy output delivered electronically to suitable hard copyoutput device (e.g., printer, facsimile, etc.), and forward as necessarythrough regular mail, courier, inter-office mail, facsimile or othersuitable forwarding approach. In one preferred embodiment, an Apacheserver variant provides an interface for remotely configuring thehardware device 210. Configuration, monitoring, and/or reporting can beprovided using some form of remote access device or software. In onepreferred embodiment, SNMP is used to configure and/or monitor thedevice. In one preferred embodiment, any suitable remote client deviceis used to send and retrieve information and commands to/from thehardware device 210. Such a remote client device can be provided in theform of a Java client or a Windows-based client running on any suitableplatform such as a conventional workstation or a handheld wirelessdevice or a proprietary client running on an appropriate platform alsoincluding a conventional workstation or handheld wireless device.

Application Layer Electronic Communication Security Enhancement

FIG. 3 depicts a block diagram of the logical components of a securityenhancement system according to the present invention. The overallanalysis, reporting and monitoring functionality is represented by block310, and anomaly detection is represented by block 370.

Blocks 320-360 represent different assessments that may be applied toelectronic communications. These blocks are representative ofassessments that may be performed and do not constitute an exhaustiverepresentation of all possible assessments for all possible applicationserver types. The terms “test” and “testing” may be used interchangeablywith the terms “assess”, “assessment” or “assessing” as appropriate inthe description herein and in the claims that follow.

-   -   Application specific firewall 320 provides functionality to        protect against application-specific attacks. For instance in        the context of e-mail, this assessment could protect against        attacks directed towards Extended SMTP, buffer overflow, and        denial of service.    -   Application specific IDS 330 provides real-time monitoring of        activities specific to the application server. This may also        retrieve information from multiple layers including the        application layer, network layer and operating system layer.        This compliments a network intrusion detection system by adding        an additional layer of application specific IDS monitoring.    -   Application specific anti-virus protection and anti-spam        protection 340 provides support for screening application        specific communications for associated viruses and/or spam.    -   Policy management 350 allows definition of corporate policies        with respect to the particular application in regard to how and        what application specific communications are sent, copied or        blocked. Executable attachments or communication components,        often sources of viruses and/or worms, and/or questionable        content can be stripped or quarantined before they get to the        application server or client Mail messages from competitors can        be blocked or copied. Large messages can be relegated to        off-peak hours to avoid network congestion.    -   Application encryption 360 provides sending and receiving        application communications securely, potentially leveraging        hardware acceleration for performance.

The application security system processes incoming communications andappears to network intruders as the actual application servers. Thisprevents the actual enterprise application server from a direct orindirect attack.

Electronic communications attempting to enter or leave a localcommunications network can be routed through present invention forassessment. The results of that assessment can determine if that messagewill be delivered to its intended recipient.

An incoming or outgoing communication, and attachments thereto, arereceived by a security system according to the present invention. Thecommunication in one preferred embodiment is an e-mail message. In otherembodiments, the communication may be an HTTP request or response, aGOPHER request or response, an FTP command or response, telnet or WAISinteractions, or other suitable Internet application communication.

The automated whitelist generation of the present invention allows thesystem to automatically create and/or maintain one or more whitelistsbased on the outbound email traffic. In some embodiments, the system canmonitor outbound, and/or inbound, email, traffic and thereby determinedie legitimate email addresses to add to the whitelist. The software canuse a set of metrics to decide which outbound addresses are actuallylegitimate addresses.

A data collection process occurs that applies one or more assessmentstrategies to the received communication. The multiple queueinterrogation approach summarized above and described in detail belowprovides the data collection functionality in one preferred embodiment.Alternatively, the assessments may be performed on each received messagein parallel. A separate processing element of the system processor wouldbe responsible for applying each assessment to the received message. Inother embodiments, multiple risk assessments may be performed on thereceived communication simultaneously using an approach such as a neuralnetwork. The application of each assessment, or the assessments in theaggregate, generates one or more risk profiles associated with thereceived communication. The risk profile or log file generated basedupon the assessment of the received communication is stored in the SDS.The collected data may be used to perform threat analysis or forensics.This processing may take place after the communication is alreadyreceived and forwarded.

In one preferred embodiment, particular assessments may be configurablyenabled or disabled by an application administrator. An appropriateconfiguration interface system may be provided as discussed above inorder to facilitate configuration by the application administrator.

An anomaly detection process analyzes the stored risk profile associatedwith the received communication in order to determine whether it isanomalous in light of data associated with previously receivedcommunications. In one preferred embodiment, the anomaly detectionprocess summarized above and described in detail below supports thisdetection functionality. Anomaly detection in some embodiments may beperformed simultaneously with assessment. For instance, an embodimentusing a neural network to perform simultaneous assessment of a receivedcommunication for multiple risks may further analyze the receivedcommunication for anomalies; in such an embodiment, the data associatedwith the previously received communications may be encoded as weightingfactors in the neural network.

In some embodiments, the thresholds for various types of anomalies maybe dynamically determined based upon the data associated with previouslyreceived communications. Alternatively, an interface may be provided toan application administrator to allow configuration of particularthresholds with respect to individual anomaly types. In someembodiments, thresholds by default may be dynamically derived unlessspecifically configured by an application administrator.

Anomalies are typically detected based upon a specific time period. Sucha time period could be a particular fixed period (e.g., prior month,prior day, prior year, since security device's last reboot, etc.) andapply to all anomaly types. Alternatively, the time period for allanomaly types, or each anomaly type individually, may be configurable byan application administrator through an appropriate interface. Someembodiments may support a fixed period default for all anomaly types, oreach anomaly type individually, which may be overridden by applicationadministrator configuration.

In one preferred embodiment, the stored risk profile associated with thereceived communication is aggregated with data associated withpreviously received communications of the same type. This newlyaggregate data set is then used in analysis of subsequently receivedcommunications of that type.

If an anomaly is detected, an anomaly indicator signal is output. Theoutputted signal may include data identifying the anomaly detected andthe communication in which the anomaly was detected. Various types ofanomalies are discussed below with respect to e-mail applicationsecurity. These types of anomalies may be detected using the specificdetection approach discussed below or any of the aforementionedalternative anomaly detection approaches.

The outputted signal may trigger a further response in some embodiments;alternatively, the outputted signal may be the response. In onepreferred embodiment, the outputted signal may be a notification to oneor more designated recipient via one or more respective, specifieddelivery platform. For instance, the notification could be in the formof an e-mail message, a page, a facsimile, an SNMP (Simple NetworkManagement Protocol) alert, an SMS (Short Message System) message, a WAP(Wireless Application Protocol) alert, OPSEC (Operations Security)warning a voice phone call or other suitable message. Alternatively,such a notification could be triggered by the outputted signal.

Using SNMP allows interfacing with network level security using amanager and agent; an example would be monitoring truffle flow through aparticular router. OPSEC is a formalized process and method forprotecting critical information. WAP is an open, global specificationthat empowers mobile users with wireless devices to easily access andinteract with information and services instantly. An example would beformatting a WAP page to a wireless device that supports WAP when ananomaly is detected. WAP pages are stripped down versions of HTML andare optimized for wireless networks and devices with small displays. SMSis a wireless technology that utilizes SMTP and SNMP for transports todeliver short text messages to wireless devices such as a Nokia 8260phone. SMS messages could be sent out to these devices to alert a userof an intrusion detection of anomaly alert.

Instead of or in addition to a notification, one or more correctivemeasures could be triggered by the outputted signal. Such correctivemeasures could include refusing acceptance of further communicationsfrom the source of the received communication, quarantining thecommunication, stripping the communication so that it can be safelyhandled by the application server, and/or throttling excessive numbersof incoming connections per second to levels manageable by internalapplication servers.

In one preferred embodiment, an interface may be provided that allows anapplication administrator to selectively configure a desired responseand associated this configured response with a particular anomaly typesuch that when an anomaly of that type is detected the configuredresponse occurs.

Finally, if an anomaly is detected with respect to a receivedcommunication, the communication may or may not be forwarded to theintended destination. Whether communications determined to be anomalousare forwarded or not may, in certain embodiments, be configurable withrespect to all anomaly types. Alternatively, forwarding of anomalouscommunications could be configurable with respect to individual anomalytypes. In some such embodiments, a default forwarding setting could beavailable with respect to any individual anomaly types not specificallyconfigured.

Threat Management Center

A TMC system can reside on a computer system in communication with oneor more application and/or network layer security systems. A typicalhardware configuration for the TMC includes a system processor and asystem data store, which can be similar in capacity to those describedherein above with respect to the application layer security systems.Typically, the communication can occur via a computer network such asthe Internet; however, one or more systems can connect to the TMC viaother mechanism including direct connection and dial-up access.

The TMC includes at least one input, a processing system, and at leastone output FIG. 13 depicts a flow chart of a rule creation process in anexemplary TMC. Input 2005 can be information about messages, messagingsystems, attacks, vulnerabilities, threats associated with them, or anyother information one skilled in the art would find relevant to threatanalysis. In addition, feedback to the TMC may also be provided by oneor more application layer security systems. The final output of the TMC2010 can includes rules and/or policies that can be used to protectagainst threats, both known and unknown by application layer securitysystems. These rules and/or policies 2010 can be used by one ore moreapplication layer security systems.

In one preferred embodiment, rule and policy creation can be based onthe set of threat information that is received. Information can bereceived from one or more MSSs or any other threat information sourceconfigured to communicate with a TMC.

The output 2010 of the TMC can be influenced by a Rules and PolicyApplication Programming Interface (API) 2015. While only one API isdepicted in the exemplary embodiment of FIG. 13, one skilled in the artwill realize that multiple APIs can be configured to perform thefunctions desired. In some embodiments, the API can be modified as oftenas necessary or desired to account for any changes in threat and/ortraffic patterns. The API can be programmed or adapted to useproprietary formats based on message interrogation systems in place onapplication layer security servers as well as standard intrusiondetection rule formats.

In some embodiments, the output of the Rules and Policy API can be in anatural language. In other embodiments the output can be in a rulesexpression language including but not limited to regular expressions,intrusion detection information format such as IDMEF, mail filteringlanguages such as SIEVE, proprietary rule expression formats or otherformats one skilled in the art would find appropriate. As a non-limitingexample, natural language output can be used to explain to anadministrator or user how to configure the system with the suggestedrules and policies.

The API can be used to improve the final set of rules generated by theTMC. As a non-limiting example, some message security systems includeinterrogation engines that use proprietary rule formats. In such asystem, a rule to block, incoming messages with a “threat.exe”attachment can be specified as:

-   Attachment Filtering Rule:-   Direction: Incoming-   Attachment threat.exe-   Action: Drop message

As a non-limiting example, a rule to block incoming messages with a“Threat Title” subject in such a system can be specified as:

-   Mail Monitoring Rule:-   Direction: Both-   Field: Subject-   Data: Threat Title-   Action: Drop message

Different embodiments can use different types of rules for performingdifferent types of filtering. If a Rules and Policy API 2015 is used,the Rule and Policy Creation module 2020 must be programmed or adaptedto communicate with the API.

The output 2010 of the TMC can be influenced by goals 2025. The goals2025 can be global goals, goals for individual messaging securityservers, or goals for individual users. As non-limiting examples, someMSS embodiments can have more conservative threat management policies.Some embodiments can be configured to use rules that are automaticallyput in place while other embodiments can be configured to use rules tobe approved by a local administrator. In some-situations it may bedesirable to use rules that discard objectionable content while in othersituations it may be desirable to quarantine that content. In othersituations, a higher or lower confidence in the likelihood of a threatbefore an action is taken may be desirable. The goals 2025 can be globalgoals or different goals for different MSSs. As a non-limiting example,the goal may be a certain effectiveness value and a certain accuracyvalue. For example, a goal can be given to the system that specifies 95%effectiveness and 99.9% accuracy for spam detection.

In some embodiments, as another goal, the system can allow one or moreusers, MSS, or other entity to provide a definition of threateningcommunications. As a non-limiting example, in the case of spam, spam maynot be well defined. Rather than allowing only a binary decision, thepresent invention can classify messages in different categories (e.g.business email, personal email, chain letters, adult language, porn, webproduct offerings, newsletters, mailing lists, etc.) In someembodiments, an individual user, administrator or other suitable humanor computerized user can register preferences concerning receipt of anyof these types of content The system can then enforce that policy forthat entity. This can be useful in the threat pushback system furtherdescribed below and depicted in FIG. 14.

Inputs to Rule and Policy creation 2020 can include, but are hot limitedto the following:

-   1. Spam and non-spam messages from archives such as SpamArchive.org,    user reported spam, spam identified by the individual messaging    security systems, information about misclassified messages,    information from databases of known spam such as Distributed    Checksum Clearinghouse (http://www.rhyolite.com/anti-spam/dcc) and    Razor (http://razor.sourceforge.net)-   2. Virus information from virus signatures, or other sources of    virus information such as virus alert newsletters, and/or virus    alert databases. The system can use this information to develop    virus information before signatures are available. This information    can be obtained from anti-virus vendors Sophos and McAfee, for    example. This information can be retrieved via HTTP, FTP, SMTP, by    direct database access, or other appropriate means. In some    embodiments, the system can create rules to block virus outbreaks    before virus signatures are available as well as for deployments    that do not have other anti-virus systems deployed.-   3. Intrusion information: This information can be extracted from    vulnerability alerts from sources such as bugtraq, CERT, software    vendors, open-source projects, information sharing projects such as    the FBI InfraGard, or other sources as appropriate. The information    can also be received from distributed intrusion detection systems or    it can be manually entered by users.

The system can perform input parsing and feature extraction according toinput type and source. In the case of spam messages, the input caninclude spam messages that are stored in proprietary formats such asMicrosoft's .pst format, Unix mbox format, forwarded spam or spam sentas an attachment, an archive of spam messages, or other source. The spammessages can be accessed from local storage or from remote storage usingprotocols such as, but not limited to, HTTP, SCP, FTP, POP, IMAP, orRPC. For an individual message, relevant features can include headers,origin, and message contents. Each type of feature can be extracted andstored as appropriate.

One preferred embodiment can use regular expression content matchingtools to parse messages and extract features. A prefilter can be usedthat defines the regular expression used for content matching. Thisdetermines the type of features that are extracted. As a non-limitingexample, for extracting message subjects, a regex filter can be usedthat only examines subject lines. To extract information about allheaders, a regex filter can be used that only observes message headers.Similarly different pre-filters can be used to extract different typesof content from the body. A normal tokenizer pre-filter can providenormal content features. These features can be words, phrases, n-grams,or other features one skilled in the art would find useful. Theprefilter can be sensitive to certain types of words including ignoringcertain email address and domain names. The prefilter can also cause thefeatures to focus on email addresses, URLs, phone numbers, etc.

The system can include an anonymization module that assures thatsensitive features are not extracted and exposed. As a non-limitingexample, the anonymization module can determine the identification ofthe spam victim and the domain and prevent exposure of that information.

For virus alerts, input can be email messages that explain the presenceand properties of a new virus or worm. The input parser can beconfigured to parse these messages and determine the relevant propertiesof a threat. These properties can include, but are not limited to, theattachment name or types, subject lines, and from addresses. The inputparser may be given different format definition files or pre-filters forthe different sources of virus alerts. Alternatively, the virus alertparser can be in communication with web pages to access otherinformation. The information can be parsed for relevant properties. Inother embodiments, the virus alert parser may interact directly with adatabase that stores such information or a user may manually enter databased on such information into the system.

The rule creation system 2020 can reside on a single system or multipleprocesses can run on multiple systems. Threat information can be reducedto a canonical form and the relevant features extracted. The system canutilize a diversity of algorithms to determine the relevant featuresand/or reduce the feature set. In some embodiments, each located featurecan be associated with an interrogation system on the MSS. The TMC candetermine the appropriate type of rule to create. In some embodiments, afeature can be expressed using a plurality of interrogation systems. Insome embodiments, feature sets can be reduced and efficient types ofrules can created.

In some embodiments, resultant rules can have a given weight and certaininterrogation systems may have some weight in the overall threat valuefor a particular message. These values can be determined based on theinput from the system. Therefore, these values can be adjusted whendesired based on new threats, feedback from the MSSs, and otherappropriate sources. The MSSs can be programmed or adapted to determinean aggregate threat likelihood based on automatically adjusted weights,or confidence values for each rule and interrogation system, or otherrelevant information. In one preferred embodiment, the rule creationsystem 2020 can include a scheduler that looks for new threatinformation.

The system first creates a set of candidate rule sets 3030. Before theseare distributed, the system can use goal-based testing 2035 to determinethe validity of these rules.

Some embodiments of the present invention can test the rules andpolicies. The test data 2045 may include threatening and non-threateningdata. The system can use the test data sets to discover false positivesand negatives of the system as well as general system performance. Thegoals 2040 used for rule creation can also used as input to the testing.Additional goals, including but not limited to, performance goals can bespecified for testing. If specified goals are not met, the system canautomatically adjust the feature sets, the weights of individualfeatures, the weights of each interrogation system, and any otherrelevant parameters to reach the goals. Once the correct tuning isachieved, the rule sets can be approved and distributed the MSSs.

Threat Pushback System

Many systems known in the art only address symptoms of an attack in thelocal environment. Besides notifying other systems that participate inthe network of MSSs, some embodiments of the present invention candetermine the source of a threat and push the threat back towards thesource. Once the source of a threat is determined, the system can sendmessages up the network to other systems in the hierarchy.

A threat pushback system can reside on a computer system as part of, oras a compliment to, an application client an application layer securitysystem or a TMC. A typical hardware configuration for the threatpushback system includes a system processor and a system data store,which can be similar in capacity to those described herein above withrespect to the application layer security systems. Typically, thecommunication can occur via a computer network such as the Internet;however, one or more other mechanism can be used including directconnection and dial-up access.

FIG. 14 depicts an exemplary threat pushback system. Two threat awaremodules 3030, 3035 are depicted. Once a threat is detected locally 3005,the threat information can be passed to a Threat Notification Module(TNM) 3020. The TNM can pass a threat notification 3040 includinginformation about the threat to the Threat Detection Module of anothersystem 3025. In a preferred embodiment, the TNM of a MSS can passinformation to another MSS. In still another embodiment, any TMN at anylocation in the network such as within, or connected to, clientapplications/systems, application, layer security, systems and/or threatmanagement centers can pass information to its parent in the networkhierarchy.

The threat notification protocol can be standardized across theparticipating systems. Some embodiments can include a threat responsemodule 3015 programmed or adapted to respond to the threat notificationinformation.

In a preferred embodiment, the system of the present invention can beprogrammed or adapted to function at the application-layer. Such anembodiment can be readily deployable. If an underlying network-layerpushback system is operational, the system can utilize some of itsfunctionality to determine the path to a threat Additionally, the threatnotification system can determine the source of the attack. As anon-limiting example, in the case of spam, to determine the source ofthe attack, message headers must be examined. The system can determinehow many of these headers can be trusted. Forged headers can beidentified and ignored. This process may include lookups to externaldatabases such as registries of IP and ASN numbers such as ARIN ordatabases of spam sources such as spamhaus.

Because an attacker may be able to forge the path information that isshown in the communication, the system can process the availableinformation to determine the correct path. This can be accomplished withany combination of application level information, network information,or information from external systems such as IP traceback systems, andother resources known to one skilled in the art. At the applicationlevel, an attacker may be able to forge some identifying information.The path determination module can provide the path information to thenotification sender module. The path determination module can include apath extraction submodule and a path verification submodule.

In one embodiment, the path extraction submodule can parse theidentifying information and provide that as the path information. Thatinformation, however, has not verified and could be inaccurate. Inanother preferred embodiment, the path verification module can processthe extracted path information to determine the valid path information.As a non-limiting example, the path extraction submodule can readmessage information such as the headers. The Return-Path or Receivedheaders can provide information regarding the path of email servers thata message traveled. The “FROM” header can be used to identify the emailaddress of the sender. The “MAIL FROM” RFC 821 header can be used toindicate the email address of the sender. The “EHLO” RFC 821 header canbe used to indicate the domain or hostname of the sender. Other headersand message features may be used including the Message-Id and the actualcontents of the message. Call for action information is contactinformation provided for the receiver such as a reply email address, aURL, a postal address, or a phone number. This information in a messagecan be used. Other information known to one skilled in the art,including but hot limited to the IP address of the network connection,can also be used.

Several verification methods can be used to determine informationauthenticity. As a non-limiting example, most of the above-mentionedheaders are easily forged; so a more reliable source is the Return-Pathor Received headers. The goal of the present invention is to determinethe longest possible authentic path. In one embodiment of the presentinvention, only the last header is used since this header represents theactual server that contacted the victim's server. Each Received headercontains Received from and Received by information. These fields can beverified with DNS for appropriate MX records, A records, and/or reverserecords, as well as other appropriate sources known to one skilled inthe art. These hosts can be checked against open relay lists, dial-upaddresses lists and known spam sources lists. The presence on any ofthese lists can provide additional information about the last accurateReceived header. Additionally, the chain of received headers can beverified against each other. Inconsistencies in this chain can also giveadditional information about die last accurate Received header. Otherdetails of these headers can be used to verify the path. As anon-limiting example, the date information and server versioninformation can be used.

Once the system determines that a pushback message needs to be forwardedin a particular direction, the system can determine what informationneeds to be included in the pushback message. The threat notification ofthe present invention includes additional detailed information about thethreat in addition to the IP address of the source.

Detailed threat information can allow systems to make local decisionsabout how to react to a threat. As a non-limiting example, the abovedescribed threat classification system can be used to process-spammessages. Information concerning a spam attack sent through the threatpushback system can include information concerning the category ofthreat and other relevant characteristics.

The receiving system can be configured to block certain portions ofcommunications at an organizational level. Furthermore, ISPs could usethis information to block certain categories of spam messages including,but not limited to, fraudulent messages. The system can be configuredsuch that an organization can have policies to block chain letters andadult language. At the desktop level, an individual can configure thesystem to block newsletters and mailing lists in addition. This allows acommon definition for blocked material as close to the source aspossible while not requiring a common definition of spam.

The threat information can indicate, among other parameters, thepresence of a threat, as well as identify the source, and/or providedetailed threat and/or response information. To identify the source, theinformation provided can include the identity of the source such as itsIP address or hostname, path information, entire determined pathinformation. Additionally, path information can be provided so thatother hosts can perform independent own extraction and/or verification.The system of the present invention can also indicate the traffic thatis determined to be a threat so that the receivers on the path candetermine the details from stored information. This systems and methodsof the present invention are an enhanced form of reverse path forwardingused in routing systems.

Whitelisting

In one embodiment, the system can be configured so that communicationsmatched to a whitelist entry may be subject to either no interrogationor less rigorous interrogation. Once a whitelist has at least one entry,the incoming message interrogation system can utilize it in connectionwith the interrogation of a message.

FIG. 10 depicts operations that can be performed on a whitelist to addan entry. Once an outgoing address passes any exclusion conditions 1005described above, it can be added to a whitelist. The whitelist can bestored on the SDS. The system first checks to see if the address isalready present on the list 1010. If present, the list can be updatedwith any new information 1015. Before new information is updated, thesystem can check for sufficient space in the SDS 1025. If sufficientspace is not available, additional space is allocated from the SDS 1030.If an address is not found in a whitelist, an initial record can beadded for that address. Before a new address is added to a whitelist1040, the system can check for sufficient space in the SDS 1020. Ifsufficient space is not available, additional space is allocated fromthe SDS 1035. In many embodiments, explicit space allocation need notoccur rather implicit space allocation occurs as a result of aninformation update 1015 or an add entry 1040.

The initial record for an outbound address can include the emailaddress, the internal email address, the message sent time, usage count,last time used and/or any other characteristics one skilled in the artwould find relevant or useful. In the case of an email address, that isalready present on a whitelist, the system can use a separate record foreach instance of that email address being used as an outbound address orthe system can maintain a single record for each outbound address with asummary of information in that entry, including information describinginstances of use. The system can store records in a number of other waysusing different data structures. The records may include otherrepresentations of data in addition to the email address, including bynot limited to a hash of the email address.

In a preferred embodiment, the system can store records in a MySQLdatabase. As a non-limiting example, the following command can be usedto build a database comprising the external and internal emailaddresses, date of last update, and an occurrence counter.

create table ct_whitelist (out_emailaddress varchar(255) not null, -External email address in_emailaddress varchar(255) not null, - Internalemail address lastupdatetime datetime, - Last update of this addresscurr_count integer, - Address occurrence counter );Maintaining the Whitelist

In some embodiments, the system can allow unlimited storage. In otherembodiments, the storage available for the list can be limited. In stillother embodiments, the system can allow for management of the size ofthe list. A number of caching techniques can be used, including but notlimited to first in first out and least recently used. Other techniquescan include an accounting of the number of internal users that reportedthe outbound address. List cleanup can occur in real-time orperiodically. Additionally, one skilled in the art will recognize that awide variety of list management techniques and procedures can be used tomanage a whitelist in connection with the present invention.

Whitelist Usage

An example of a system using a whitelist according to the presentinvention is shown in FIG. 9. One or more relevant parameters of inboundcommunication 905 are compared against one or more whitelists 910. Insome embodiments, the whitelist is checked at each incoming emailmessage. In a preferred embodiment, the comparison includes originationemail addresses. If the check against a whitelist 910 reveals no match,then the message is subject to normal message interrogation 915. Normalmessage interrogation can employ analysis criteria that are the mostsensitive to spam or other threats as discussed hereinabove. If amessage passes normal interrogation 915, i.e. it is determined not to bespam or a threat (or to have a lower likelihood of being spam or athreat), it can be presented to its intended recipient for delivery 920.If the check against a whitelist 910 reveals a match, the system can beconfigured to process the message in a variety of ways. In oneembodiment, the system can be programmed or arranged to bypass 925 anymessage interrogation and deliver the message to its intended recipient920. In an alternative embodiment, the system can be programmed orarranged to process the message using adaptive message interrogation930. If adaptive message interrogation 930 determines a message is, notspam, it can forward the message for delivery 920.

In some embodiments, both options 925, 930 are selectively available.The decision whether to pass whitelisted communications through adaptivemessage interrogation 930 or to bypass any message interrogation 925 canbe made per deployment or can be based on the details of the whitelistentry. For instance, messages from more frequently used outbound addresscan bypass 925 interrogation completely whereas messages from lessfrequently used outbound addresses can be subjected to adaptive messageinterrogation 930.

If the message goes through normal or adaptive interrogation with thewhitelist information, the interrogation module can utilize thewhitelist information to effect the type and/or level of interrogation.In some preferred embodiments, the adaptive message interrogation canuse multiple levels of trust, as further described below and in FIG. 11.In other embodiments, the adaptive message interrogation can set aconfidence indicator indicative of the confidence the interrogator hasin its characterization.

Messages that are not delivered to the intended recipient can be eitherquarantined or deleted. In an alternative embodiment, messagesdetermined to be spam can be indicated as spam or a threat and forwardedto the intended recipient.

Additionally, each outbound email address can be assigned a confidencevalue. According to the confidence value associated with a givenincoming email address, incoming messages can be subjected to variablelevels of interrogation. In one preferred embodiment, incoming messagesassociated with lower confidence values are subjected to more aggressivespam interrogation and incoming messages associated with higherconfidence values are subjected to less aggressive spam interrogation.In other embodiments, the message can be given positive credits tooffset any negative spam detection points based on the confidence value.

One preferred embodiment of the system allows some or all external emailrecipients to be whitelisted 935. Some embodiments can have a metricthat describes the number of outgoing messages to a particular emailaddress. When the metric reaches a certain threshold, the email addresscan be whitelisted. Other embodiments can include the ability to trackaddresses over time. In those embodiments, if the metric exceeds acertain value for a particular outbound email address during aparticular time, then that entry can be whitelisted.

The parameters described above may be configurable by an applicationadministrator through an appropriate interface. Some embodiments maysupport fixed parameters which may be overridden by applicationadministrator configuration.

In some embodiments, the threshold for characterization as spam or athreat may be dynamically determined based upon the data associated withpreviously received communications. Alternatively, an interface may beprovided to an application administrator to allow configuration ofparticular thresholds with respect to individual addresses. In someembodiments, thresholds by default may be dynamically derived unlessspecifically configured by an application administrator.

When spam or a threat is detected, instead of, or in addition to, anotification, one or more response measures could be triggered. Suchresponsive measures could include refusing acceptance of furthercommunications from the source of the received communication,quarantining the communication, stripping the communication so that itcan be forwarded to its intended recipient, and/or throttling excessivenumbers of incoming communications from certain sources.

Authenticated Whitelist

One issue with whitelists is that attackers or spammers can pretend tosend messages from whitelisted addresses and therefore bypass filteringand anti-spam tools. It is relatively easy for an attacker to forge thesender information on messages. To overcome this limitation ofwhitelists, the system of the present invention allows theauthentication of the sender information. There are several methods forintegrating sender authentication with a whitelist-system. In oneembodiment, only authenticated senders can be whitelisted. Such aprocedure can reduce the likelihood of forged senders being whitelisted.However, in many environments, the percentage of messages that areauthenticated is low, thereby reducing the effectiveness ofwhitelisting. Some embodiments of the present invention can allow bothauthenticated and unauthenticated senders to be whitelisted. In theseembodiments; a higher trust value is given to messages fromauthenticated senders. SMIME and PGP offer mechanism for providing,authentication.

One such embodiment is depicted in FIG. 11. As a non-limiting example,when a message 1105 is received from a sender on a whitelist 1115 anassociated level of trust is retrieved or calculated 1135. In someembodiments, the trust level value is a single value associated with thewhitelist entry that simply requires retrieval. In other embodiments,the trust level value can be calculated as a weighted sum of variouscharacteristics of the entry; in some such embodiments, the weights, canbe statically defined, defaulted subject to override by a user or othercomputer system or dynamically configurable. That associated level oftrust can be compared to a threshold level 1140. Any communications thathave a trust level that meets or exceeds the trust level threshold canbypass message interrogation 1120 while communications that do not havea trust sufficient trust level will be processed with at least someinterrogation 1125. Messages that bypass interrogation 1120 as well asmessages that pass interrogation 1125 can be delivered to the intendedrecipient 1145. In such an embodiment, messages not associated with awhitelist entry are subjected to interrogation and further processing1150.

Some embodiments of the present invention can allow the trust levelthreshold 1130 to be configured by an administrator, other user of thesystem or other computer systems.

Exclusions from Whitelist

The spam/threat detection according to present invention examines everyoutbound message and maintains a list of known outbound email addresses.The resulting list can then be used as the list of trusted senders.However, it may not be advisable in all cases to add every outboundmessage recipient to the list of trusted senders for incoming mail. Forexample, while a user may send a message to a newsgroup, that does notindicate that messages from this newsgroup should necessarily bypassmail filtering. To further illustrate, a user may send an unsubscribemessage to a newsletter or in response to a spam message. Thus, therecan be situations in which unconditional whitelist addition is notadvisable. The system of the present invention allows certain exclusionconditions to be entered and applied.

These exclusion conditions can include rule sets, heuristics, artificialintelligence, decision trees, or any combination thereof. The conditionscan be set by and administrator or other user of the system.

Multiple Queue Approach to Interrogation of Electronic Communications

With reference to FIG. 7, a multiple queue approach is provided forapplying a plurality of risk assessments to a received communication.

Messages are first placed in an unprocessed message store 730, a portionof the SDS, for advanced processing and administration. Messages come infrom an external source 740 and are placed in this store 730. This store730 maintains physical control over the message until the end of theprocess or if a message does not pass interrogation criteria and is,therefore, quarantined.

An index to the message in the store 730 is used to pass through each ofthe queues 771B, 781B-784B, 791B in the queuing layer 720 and to theinterrogation engines 771A, 781A-784A, 791A instead of the actualmessage itself to provide scalability and performance enhancements asthe index is significantly smaller than the message itself.

Both the queues and the interrogation engines use the index to pointback to the actual message in the unprocessed message store 730 toperform actions on the message. Any suitable index allocation approachmay be used to assign an index to a received message, or communication.For instances, indices may be assigned by incrementing the indexassigned to the previously received communication beginning with somefixed index such as 0 for the first received communication; the indexcould be reset to the fixed starting point after a sufficiently largeindex has been assigned. In some embodiments, an index may be assignedbased upon characteristics of the received communication such as type ofcommunication, time of arrival, etc.

This approach provides independent processing of messages by utilizing amulti-threaded, multi-process methodology, thereby providing a scalablemechanism to process high volumes of messages by utilizing amulti-threaded, multi-process approach.

By processing messages independently, the queuing layer 720 decides themost efficient means of processing by either placing an index to themessage on an existing queue or creating a new queue and placing theindex to the message on that queue. In the event that a new queue iscreated, a new instance of the particular interrogation engine type willbe created mat will be acting on the new queue.

Queues can be added or dropped dynamically for scalability andadministration. The application administrator can, in one preferredembodiment, configure the original number of queues to be used by thesystem at start-up. The administrator also has the capability ofdynamically dropping or adding specific queues or types of queues forperformance and administration purposes. Each queue is tied to aparticular interrogation engine where multiple queues and multipleprocesses can exist.

Proprietary application-specific engines can act on each queue forperforming content filtering, rules-based policy enforcement, and misuseprevention, etc. A loosely coupled system allows for proprietaryapplication-specific applications to be added enhancing functionality.

This design provides the adaptive method for message interrogation.Application-specific engines act on the message via the index to themessage in the unprocessed message store for completing contentinterrogation.

Administration of the queues provides for retrieving message details viaan appropriate interface such as a Web, e-mail and/or telephone basedinterface system as discussed above in order to facilitate access andmanagement by the application administrator. Administration of thequeues allows the administrator to select message queue order (otherthan the system default) to customize the behavior of the system to bestmeet the needs of the administrator's particular network and systemconfiguration.

FIGS. 8A-8B are flow charts depicting use of the multiple queue approachto assess risk associated with a received communication. At step 802 adetermination is made if the start-up of the process is being initiated;if so, steps 805 and 807 are performed to read appropriate configurationfiles from the SDS to determine the type, number and ordering ofinterrogation engines and the appropriate queues and instances arecreated. If not, the process waits at step 810 for receipt of acommunication.

Upon receipt at step 812, the communication is stored in a portion ofthe SDS referred to as the unprocessed message store. The communicationis assigned at step 815 an index used to uniquely identify it in theunprocessed message store, and this index is placed in the first queuebased upon the ordering constraints.

The processing that occurs at step 810 awaiting receipt of communicationcontinues independently of the further steps in this process, and willconsequently spawn a new traversal of the remainder of the flow chartwith each received communication. In some embodiments, multipleinstances of step 810 may be simultaneously awaiting receipt ofcommunications.

In some embodiments, the receipt of a communication may trigger a loadevaluation to determine if additional interrogation engines andassociated queues should be initiated. In other embodiments, a separateprocess may perform this load analysis on a periodic basis and/or at thedirection of an application administrator.

The index moves through the queue 820 until it is ready to beinterrogated by the interrogation engine associated with the queue asdetermined in step 825. This incremental movement is depicted as loopingbetween steps 820 and 825 until ready for interrogation. If thecommunication is not ready for evaluation at step 825, the communicationcontinues moves to move through the queue at step 820. If thecommunication is ready, the index is provided to the appropriateinterrogation engine at step 830 in FIG. 8B.

The interrogation engine processes the communication based upon itsindex in step 830. Upon completion of interrogation in step 835, theinterrogation creates a new risk profile associated with the receivedcommunication based upon the interrogation.

If additional interrogations are to occur (step 840), the index for thecommunication is place in a queue for an instance of the nextinterrogation type in step 845. Processing continues with step 820 asthe index moves through this next queue.

If no more interrogations are required (step 840), a further check ismade to determine if the communication passed interrogation by allappropriate engines at step 850. If the communication passed allinterrogations, men it is forwarded to its destination in step 855 andprocessing with respect to this communication ends at step 870.

If the communication failed one or more interrogation as determined atstep 850, failure processing occurs at step 860. Upon completion ofappropriate failure processing, processing with respect to thiscommunication ends at step 870.

Failure processing may involve a variety of notification and/orcorrective measures. Such notifications and/or corrective measures mayinclude those as discussed above and in further detail below withrespect to anomaly detection.

Anomaly Detection Process

The Anomaly Detection process according to an exemplary embodiment ofthe present invention uses three components as depicted in FIG. 6:

1. Collection Engine

This is where the actual collection of data occurs. The collectionengine receives a communication directed to or originating from anapplication server. One or more tests are applied to the receivedcommunication. These one or more tests may correspond to the variousrisk assessments discussed above.

The collection engine in one preferred embodiment as depicted in FIG. 6uses the multiple queue approach discussed above; however, thisparticular collection engine architecture is intended as exemplaryrather than restrictive with respect to collection engines usable withinthe context of this anomaly detection process.

As depicted in FIG. 6, the collection engine includes one or moreinterrogation engines of one or more interrogation engine types in aninterrogation layer 610. Associated with each interrogation engine typein a queuing layer 620 is at least one indices queue containing theindices of received communication awaiting interrogation by aninterrogation engine of the associated type. Collectively, the queuinglayer 620 and the interrogation layer 610 form the collection engine. Areceived communication is received, stored in the SDS and assigned anindex. The index is queued in the queuing layer for processing throughthe collection engine.

2. Analysis Engine

The data collected by the previous component is analyzed for unusualactivity by the anomaly detection engine 640. The analysis is based ondata accumulated from analysis of previously received communicationsover a period of time. A set of predefined heuristics may be used todetect anomalies using dynamically derived or predetermined thresholds.A variety of anomaly types may be defined generally for all types ofInternet application communications while others may be defined for onlyparticular application types such as e-mail or Web. The data associatedwith previously received communications and appropriate configurationdata 630 are stored in the SDS.

The set of anomaly types that the analysis engine will detect may beselected from a larger set of known anomaly types. The set of interestmay be set at compile time or configurable at run time, or duringexecution in certain embodiments. In embodiments using the set approachall anomaly types and configuration information are set within theanalysis engine. In some such embodiments, different sets of anomaliesmay be of interest depending upon the type of communication received. Inconfigurable at run time embodiments, anomaly types are read from aconfiguration file or interactively configured at run time of theanalysis engine. As with the set approach, certain anomaly types may beof interest with respect to only selected types of communication.Finally, in some embodiments (including some set or configurable ones),an interface such as described above may be provided allowingreconfiguration of the anomaly types of interest and parametersassociated therewith while the analysis engine is executing.

The thresholds for various types of anomalies may be dynamicallydetermined based upon the data associated with previously receivedcommunications. Alternatively, an interface may be provided to anapplication administrator to allow configuration of particularthresholds with respect to individual anomaly types. In someembodiments, thresholds by default may be dynamically derived unlessspecifically configured by an application administrator.

Anomalies are typically detected based upon a specific time period. Sucha time period could be a particular fixed period (e.g., prior month,prior day, prior year, since security device's last reboot, etc.) andapply to all anomaly types. Alternatively, the time period for allanomaly types, or each anomaly type individually, may be configurable byan application administrator through an appropriate interface such asthose discussed above. Some embodiments may support a fixed perioddefault for all anomaly types, or each anomaly type individually, whichmay be overridden by application administrator configuration.

In one preferred embodiment, as depicted in FIG. 6, information from therisk profiles 642, 644, 646 generated by the collection engine iscompared with the acquired thresholds for anomaly types of interest.Based upon these comparisons, a determination is made as to whether thereceived communication is anomalous, and if so, in what way (anomalytype) the communication is anomalous.

In one preferred embodiment, the stored risk profile associated with thereceived communication is aggregated with data associated withpreviously received communications of the same type. This newlyaggregate data set is then used in analysis of subsequently receivedcommunications of that type.

If an anomaly is detected, an anomaly indicator signal is output Theoutputted signal may include data identifying the anomaly type detectedand the communication in which the anomaly was detected such as alertdata 650. Various types of anomalies are discussed below with respect toe-mail application security. These types of anomalies may be detectedusing the specific detection approach discussed below or any of theaforementioned alternative anomaly detection approaches.

3. Action Engine

Based on the analysis, this component takes a decision of what sort ofaction needs to be triggered. Generally the action involves alerting theadministrator of the ongoing unusual activity. An alert engine 660performs this task by providing any appropriate notifications and/orinitiating any appropriate corrective actions.

The outputted signal may trigger a further response in some embodiments;alternatively, the outputted signal may be the response. In onepreferred embodiment, the outputted signal may be a notification to oneor more designated recipient via one or more respective, specifieddelivery platform. For instance, the notification could be in the formof an e-mail message, a page, a facsimile, an SNMP alert, an SMSmessage, a WAP alert, OPSEC warning a voice phone call or other suitablemessage. Alternatively, such a notification could be triggered by theoutputted signal.

Instead of or in addition to a notification, one or more correctivemeasures could be triggered by the outputted signal. Such correctivemeasures could include refusing acceptance of further communicationsfrom the source of the received communication, quarantining thecommunication, stripping the communication so that it can be safelyhandled by the application server, and/or throttling excessive numbersof incoming connections per second to levels manageable by internalapplication servers.

In one preferred embodiment, an interface may be provided that allows anapplication administrator to selectively configure a desired responseand associate this configured response with a particular anomaly typesuch that when an anomaly of that type is detected the configuredresponse occurs.

FIG. 4 depicts a flow chart in a typical anomaly detection processaccording to one preferred embodiment of the present invention. Theprocess starts in step 410 by initializing various constraints of theprocess including the types of anomalies, thresholds for these types andtime periods for which prior data is to be considered. This informationmay be configured interactively at initiation. In addition to, orinstead of, the interactive configuration, previously storedconfiguration information may be loaded from the SDS.

The process continues at step 420 where anomaly definitional informationis read (e.g., Incoming messages that have the same attachment within a15 minute interval). A determination is then made as to whether a newthread is needed; this determination is based upon the read the anomalydetails (step not shown). In step 430, if a new thread is required, thethread is spun for processing in step 450. In step 440, the processsleeps for a specified period of time before returning to step 420 toread information regarding an anomaly.

Once processing of the new thread commences in step 450, informationneeded to evaluate the anomaly is retrieved from appropriate locationsin the SDS, manipulated if needed, and analyzed in step 460. Adetermination in step 470 occurs to detect an anomaly. In one preferredembodiment, this step uses predetermined threshold values to make thedetermination; such predetermined threshold values could be providedinteractively or via a configuration file. If an anomaly is notdetected, the process stops.

If an anomaly is detected, an anomaly indicator signal is output at step480 which may result in a notification. The possible results of anomalydetection are discussed in more detail above with respect to the ActionEngine.

The types of anomalies may vary depending upon the type and nature ofthe particular application server. The following discussion providesexemplary definitions of anomalies where e-mail is the applicationcontext in question. Anomalies similar, or identical, to these can bedefined with respect to other application server types.

There are many potential anomaly types of interest in an e-mail system.The analysis is based on the collected data and dynamic rules fornormality based on the historic audited data. In some embodiments, anapplication administrator can be provided with an interface forconfiguring predefined rules with respect to different anomaly types.FIG. 5 provides a sample screen for such an interface. The interfacefunctionality may be provided via a Web server running on the securityenhancement device or other suitable interface platform as discussedabove.

In one preferred embodiment, the threshold value for the analysis foreach anomaly is derived from an anomaly action table. The action foreach anomaly is also taken from this table. The analysis identifies thatsome thing unusual has occurred and hands over to the action module.Enumerated below with respect to e-mail are anomalies of various types.

-   1. Messages from same IP Address—The point of collection for this    anomaly is SMTPI/SMTPIS service. SMTPI/SMTPIS has information about    the IP address from which the messages originate. The IP address is    stored in the SDS. The criterion for this anomaly is that the number    of message for the given period from the same IP address should be    greater than the threshold. Based on the level of threshold,    suitable alert is generated.-   2. Messages from same Address (MAIL FROM)—The point of collection    for this anomaly is SMTPI/SMTPIS service. SMTPI/SMTPIS has    information about the address (MAIL FROM) from which the messages    originate. The determined address is stored in the SDS. The    criterion for this anomaly is that, the number of message for the    given period with the same MAIL FROM address should be greater man    the threshold. Based on the level of threshold, suitable alert is    generated.-   3. Messages having same Size—The point of collection for this    anomaly is SMTPI/SMTPIS service. SMTPI/SMTPIS has information about    the size of the messages. The size of the message is stored in the    SDS. This size denotes the size of the message body and does not    include the size of the headers. The criterion for this anomaly is    that the number of message for the given period with a same size    should be greater than the threshold Based on the level of    threshold, suitable alert is generated.-   4. Messages having same Subject—The point of collection for this    anomaly is SMTPI/SMTPIS service. SMTPI/SMTPIS has information about    the subject line of the message. The subject line information for    the message is stored in the SDS. The criterion for this anomaly is    that the number of message for the given period with the same    subject line should be greater than the threshold. Based on the    level of threshold, suitable alert is generated.-   5. Messages having same Attachment—The point of collection for this    anomaly is the MIME Ripper Queue. The MIME Ripper Queue parses the    actual message into the constituent MIME parts and stores the    information in the SDS. A part of this information is the attachment    file name. The criterion for this anomaly is that the number of    message for the given period with same attachment name should be    greater than the threshold. Based on the level of threshold,    suitable alert is generated.-   6. Messages having same Attachment Extension—The point of collection    for this anomaly is the MIME Ripper Queue. The MIME Ripper Queue    parses the actual message into the constituent MIME parts and stores    the information in the SDS. A part of this information is the    attachment file extension. The criterion for this anomaly is that    the number of message for the given period with same extension    should be greater than the threshold. Based on the level of    threshold, suitable alert is generated.-   7. Messages having Viruses—This anomaly will be detected only if any    of the anti-virus queues are enabled. The point of collection for    this anomaly is the anti-virus Queue. The anti-virus Queue scans for    any viruses on each individual MIME parts of the message. The scan    details are stored in the SDS. A part of this information is the    virus name. The criterion for this anomaly is that the number of    message for the given period detected with viruses should be greater    than the threshold. Based on the level of threshold, suitable alert    is generated.-   8. Messages having same Virus—This anomaly will be detected only if    any of the anti-virus queues are enabled. The point of collection,    for this anomaly is the anti-virus Queue. The anti-virus Queue scans    for any viruses on each individual MIME parts of the message. The    scan details are entered into the SDS. A part of this information is    the virus name. The criterion for this anomaly is that the number of    message for the given period detected with same virus should be    greater than the threshold. Based on the level of threshold,    suitable alert is generated.

The table below depicts the fields in an anomaly table in one preferredembodiment using a relational database model for storing thisinformation in the SDS.

SI No. Field Name Data Type Remarks 1. anm_type int Primary key. Uniqueidentifier for all anomalies. The list is given in next section. 2.anm_name varchar Name on the Anomaly (Tag for the UI to display) 3.can_display tinyint Anomaly is displayable or not in UI. 0 - Do notdisplay 1 - Display 4. is_enabled tinyint Specifies if the anomaly isenabled or not 0 - Disabled 1 - Enabled 5. anm_period int Time inminutes. This time specifies the period for the anomaly check.

The table below depicts the fields in an anomaly action table in onepreferred embodiment using a relational database model for storing thisinformation in the SDS.

SI No. Field Name Data Type Remarks 1. anm_type int Foreign key fromanomaly table. 2. anm_thresh int This value specifies the threshold fora particular action to be taken. 3. alert_type int This is foreign keyfrom alert_type table. This value specifies the type of alert to be sentto the alert manager when this anomaly is detected.

Throughout this application, various publications may have beenreferenced. The disclosures of these publications in their entiretiesare hereby incorporated by reference into this application in order tomore fully describe the state of the art to which this inventionpertains.

The embodiments described above are given as illustrative examples only.It will be readily appreciated by those skilled in the art that manydeviations may be made from the specific embodiments disclosed in thisspecification without departing from the invention. Accordingly, thescope of the invention is to be determined by the claims below ratherthan being limited to the specifically described embodiments above.

The invention claimed is:
 1. A computer-implemented method comprising:receiving a communication from a first sender destined to a recipient ina network; accessing a whitelist specifying approved senders, each ofthe approved senders having a trust score indicative of a level of trustassociated with the respective approved sender, wherein the trust scorefor each approved sender is based at least in part on a respectivefrequency with which communications originating within the network aresent to the approved sender, and higher frequencies of communicationsoriginating within the network sent to the approved sender correspondwith higher levels of trust; determining, using at least one dataprocessing apparatus, whether the first sender is one of the approvedsenders; in response to determining that the first sender is not one ofthe approved senders: determining whether a threat level of thecommunication exceeds a threshold threat level; in response todetermining that the threat level does not exceed a threshold threatlevel, delivering the communication to the recipient; and in response todetermining that the first sender is one of the approved senders:determining whether the trust score for the first sender exceeds athreshold trust score; in response to determining that the trust scoreexceeds the threshold trust score, delivering the communication to therecipient; and in response to determining that the trust score does notexceed the threshold trust score, selecting one of a plurality ofinterrogation levels to which the communication will be subjected. 2.The method of claim 1, further comprising: in response to determiningthat the threat level exceeds the threshold threat level, preventing thecommunication from being delivered to the recipient.
 3. The method ofclaim 2, wherein preventing the communication from being delivered tothe recipient comprises quarantining or deleting the communication. 4.The method of claim 1, wherein a first approved sender receiving a firstfrequency of communications originating within the network higher than asecond frequency of communications originating within the networkreceived by a second approved sender will have a higher trust score thanthe second approved sender.
 5. The method of claim 1, furthercomprising: determining a frequency with which communicationsoriginating within the network are sent to a unclassified sender,wherein the whitelist does not specify the unclassified sender as anapproved sender; and updating the whitelist to specify the unclassifiedsender as an approved sender in response to determining that thefrequency exceeds a sender destination threshold frequency.
 6. Themethod of claim 1, wherein the communication is an email message and thewhitelist specifies an email address for each of the approved senders.7. The method of claim 1, wherein determining whether a threat level ofthe communication exceeds a threshold threat level comprises determiningwhether the communication is spam.
 8. The method of claim 1, whereineach of the plurality of interrogation levels includes a particularnumber and type of interrogation engines to interrogate thecommunication.
 9. The method of claim 8, wherein the type ofinterrogation engines include a spam interrogation engine and one ormore virus interrogation engines.
 10. The method of claim 1, whereinselecting one of a plurality of interrogation levels to which thecommunication will be subjected comprises selecting the one of aplurality of interrogation levels to which the communication will besubjected based on a value of the trust score.
 11. A system comprising:a data processing apparatus; and software stored on a computer storageapparatus and comprising instructions executable by the data processingapparatus and upon such execution cause the data processing apparatus toperform operations comprising: receive a communication from a firstsender destined to a recipient in a network; access a whitelistspecifying approved senders, each of the approved senders having a trustscore indicative of a level of trust associated with the respectiveapproved sender, wherein the trust score for each approved sender isbased at least in part on a respective frequency with whichcommunications originating within the network are sent to the approvedsender, and higher frequencies of communications originating within thenetwork sent to the approved sender correspond with higher levels oftrust; determine whether the first sender is one of the approvedsenders; in response to determining that the first sender is not one ofthe approved senders: determine whether a threat level of thecommunication exceeds a threshold threat level; in response todetermining that the threat level does not exceed a threshold threatlevel, deliver the communication to the recipient; and in response todetermining that the first sender is one of the approved senders:determine whether the trust score for the first sender exceeds athreshold trust score; in response to determining that the that scoreexceeds the threshold trust score, deliver the communication to therecipient; and in response to determining that the trust score does notexceed the threshold trust score, select one of a plurality ofinterrogation levels to which the communication will be subjected. 12.The system of claim 11, wherein the data processing apparatus furtherperforms operations comprising: in response to determining that thethreat level exceeds the threshold threat level, prevent thecommunication from being delivered to the recipient.
 13. The system ofclaim 12, wherein prevent the communication from being delivered to therecipient comprises quarantine or delete the communication.
 14. Thesystem of claim 11, wherein a first approved sender receiving a firstfrequency of communications originating within the network higher than asecond frequency of communications originating within the networkreceived by a second approved sender will have a higher trust score thanthe second approved sender.
 15. The system of claim 11; wherein the dataprocessing apparatus further performs operations comprising: determine afrequency with which communications originating within the network aresent to a unclassified sender, wherein the whitelist does not specifythe unclassified sender as an approved sender; and update the whitelistto specify the unclassified sender as an approved sender in response todetermining that the frequency exceeds a sender destination thresholdfrequency.
 16. The system of claim 11, wherein the communication is anemail message and the whitelist specifies an email address for each ofthe approved senders.
 17. The system of claim 11, wherein each of theplurality of interrogation levels includes a particular number and typeof interrogation engines to interrogate the communication.
 18. Anon-transitory computer storage medium encoded with a computer program;the program comprising instructions that when executed by a dataprocessing apparatus cause the data processing apparatus to performoperations, comprising: receiving a communication from a first senderdestined to a recipient in a network; accessing a whitelist specifyingapproved senders, each of the approved senders having trust scoreindicative of a level of trust associated with the respective approvedsender, wherein the trust score for each approved sender is based atleast in part on a respective frequency with which communicationsoriginating within the network are sent to the approved sender, andhigher frequencies of communications originating within the network sentto the approved sender correspond with higher levels of trust;determining whether the first sender is one of the approved senders; inresponse to determining that the first sender is not one of the approvedsenders: determining whether a threat level of the communication exceedsa threshold threat level; in response to determining that the threatlevel does not exceed a threshold threat level, delivering thecommunication to the recipient, and in response to determining; that thefirst sender is one of the approved senders: determining whether thetrust score for the first sender exceeds a threshold trust score; inresponse to determining that the trust score exceeds the threshold trustscore, delivering the communication to the recipient; and in response todetermining that the trust score does not exceed the threshold trustscore, selecting one of a plurality of interrogation levels to which thecommunication will be subjected.